@taewooopark/agent-blackbox 0.46.3 → 0.46.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/agent-blackbox.plugin.mjs +4 -1
- package/dist/cli.js +2 -1
- package/package.json +1 -1
|
@@ -184,7 +184,10 @@ var defaultRedactionRules = [
|
|
|
184
184
|
},
|
|
185
185
|
{
|
|
186
186
|
name: "private-key",
|
|
187
|
-
|
|
187
|
+
// Tempered quantifier: the body cannot cross another BEGIN marker. Without it, a
|
|
188
|
+
// lone BEGIN with no END forces a scan to end-of-string from every BEGIN — O(n²)
|
|
189
|
+
// backtracking on untrusted tool output peppered with BEGIN markers (slow-path DoS).
|
|
190
|
+
pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----(?:(?!-----BEGIN )[\s\S])*?-----END [A-Z ]*PRIVATE KEY-----/g,
|
|
188
191
|
replacement: "[REDACTED_PRIVATE_KEY]"
|
|
189
192
|
}
|
|
190
193
|
];
|
package/dist/cli.js
CHANGED
|
@@ -1109,9 +1109,10 @@ function upsertManagedBlock(content, block) {
|
|
|
1109
1109
|
${block}
|
|
1110
1110
|
`;
|
|
1111
1111
|
}
|
|
1112
|
+
var managedBlockSeamRegExp = () => new RegExp(`\\n*${escapeRegExp(EFFICIENCY_MEMORY_START)}[\\s\\S]*?${escapeRegExp(EFFICIENCY_MEMORY_END)}\\n*`, "g");
|
|
1112
1113
|
function removeManagedBlock(content) {
|
|
1113
1114
|
if (!hasManagedBlock(content)) return content;
|
|
1114
|
-
const stripped = content.replace(
|
|
1115
|
+
const stripped = content.replace(managedBlockSeamRegExp(), "\n\n").trimEnd();
|
|
1115
1116
|
return stripped.length === 0 ? "" : `${stripped}
|
|
1116
1117
|
`;
|
|
1117
1118
|
}
|
package/package.json
CHANGED